nx_tls13_recv_hs_probe_test.nx

nx_tls13_recv_hs_probe_test.nx -- B1 instrument (pm_plan arc=BROWSER step=B1-RECVHS-EXAMPLE): example.com handshakes to recv_sh GREEN (sh-probe RV=1) but session_run dies SR=-7 (RUN_RECV_HS_FAIL) in the ENCRYPTED handshake -- recv_hs collapses every dispatcher failure to DISPATCH_FAIL, hiding the locus. This probe replicates recv_hs's walk per record with step markers (the KD= cascade pattern that localized the tail-call miscompile), composing the shipped primitives UNCHANGED: RC=/CT=/TL= record number, outer ContentType, total bytes DV=/IC=/PL= record-decrypt verdict, inner ContentType, plaintext len MT=/ML= each handshake message type + body length PV= at WAIT_CERT: the cert pipeline's EXACT verdict (2..12 = msg-bad/parse/validity/SAN/DN/SIG/anchor) CN=/XV=/SA=/SS=/PA= per served cert: index, x509_parse rc, sig-alg id, sig-alg SUPPORTED flag, pubkey-alg id (the P-384/RSA-PSS suspicion becomes a measured fact here) DW=/ST= dispatcher verdict, new session state Exit 0 iff the handshake reaches WAIT_CLIENT_FIN (server Finished verified) -- the bar for landing this module as the B1 gate row. Until the fix, the nonzero exit + markers ARE the Doctor's input. Prereq: /tmp/mozilla_certdata.txt staged (browser gate self-stages it). expect_exit: 0 (once B1 is healed; today it names the defect) license_tier: ORIGINAL